We rely on game theory and tamper proof audit logs. 100% of the things done to access/modify our secrets & infrastructure are logged in our cloud ecosystem in

We rely on game theory and tamper proof audit logs. 100% of the things done to access/modify our secrets & infrastructure are logged in our cloud ecosystem in a manner completely outside our control (AWS or Azure hold the log). We cannot delete or edit these. All we can do is read them and receive reports or alerts. If someone with global admin decides they want to become DBA over a highly-sensitive SQL Server instance, nothing would actually stop them from acquiring this access. We aren't protecting nuclear material or other defense/life-safety-critical items. If someone wants to risk their career to do the wrong thing with our data (or our customers' data), then I say go for it. I will lose exactly zero sleep terminating someone who does something that stupid. Our policy isn't even explicit. This is one of those "if you have to ask, you shouldn't be working here" kinds of things. Fear is a much more efficient tool than key splitting schemes, physical vaults, armed guards, etc.